Malicious Claude Code extension on Cursor's marketplace installed a backdoor

[Sekiro68]

Developers using one code editor's extension store have been warned about a backdoor. The Register reports that a malicious version of the Claude Code extension was available on Cursor's marketplace for about 11 hours on Thursday 29 October

Security firm Phorion first spotted version 2.1.313. It installed a persistent SSH backdoor on Windows, macOS and Linux, harvested usernames, Git email addresses and public IP addresses, added the attacker's SSH key and tried to open a reverse SSH tunnel. The tunnel usually failed because it needs administrator rights on macOS and Windows

Some security commentators claimed up to 5,000 developers were infected and that the upload followed a breach at Anthropic, but The Register could not verify either claim. Anthropic's Felix Rieseberg said on X that it was not a compromise of Anthropic's systems or employee laptops, explaining that a malicious actor used access to Cursor's marketplace, and that versions on Anthropic's official channels are not affected

Cursor removed the version, shut down its whole marketplace as a precaution, rotated its keys and worked with a hosting provider to block the attacker's server. Updating the extension does not remove the backdoor, so Cursor's advisory includes removal scripts. Neither company has explained how the malicious package got onto the marketplace

Extension marketplaces are an attractive target, because developers install extensions with broad access to their machines. Anyone who installed the extension through Cursor during that window should run the removal steps. It is another reminder that the software supply chain is only as strong as its weakest store

How much do you trust extension marketplaces? And should code editors check extensions more strictly?

Anthropic: That Claude Code extension compromise... couldnwww.theregister.com